Security and API Planning: Entropy, Rate Limits, and Collisions
Password entropy, URL query parameter counting, hash collision probability, and API rate limits — four calculations for planning secure, well-behaved systems.
Security and API design both benefit from replacing intuition with an actual number — these four calculations do exactly that.
Password entropy: quantifying password strength
A 16-character password drawn from the full 94-character printable ASCII set has entropy of 16 × log₂(94) ≈ 104.9 bits — well above the 80-bit threshold often considered very strong. Entropy assumes true randomness, though; predictable patterns or dictionary words reduce real-world security far below the calculated value.
URL query parameter counting: parsing tracking and API URLs
A URL like "/search?q=test&page=2&sort=asc" has exactly 3 query parameters, split on the "&" characters after the "?". This kind of parsing comes up constantly when debugging tracking links or inspecting API request URLs.
Hash collision probability: the birthday paradox for hashes
Even with a 32-bit hash space (over 4 billion possible values), hashing just 10,000 items already creates a meaningful collision probability — the same "birthday paradox" math that makes shared birthdays common in surprisingly small groups. This is why cryptographic hashes use vastly larger hash spaces than a naive intuition might suggest is necessary.
API rate limits: converting a limit into a usable budget
A rate limit of 100 requests per 60 seconds translates to 6,000 requests over an hour — useful for planning how to batch or spread out API calls without a client script tripping the limit and getting throttled.
Planning with real numbers instead of guesses
Whether you're setting a password policy, parsing URLs, choosing a hash size, or budgeting API calls, these four calculations replace a gut feeling with an actual figure. Try the password entropy calculator, URL query parameter counter, hash collision probability calculator, and API rate limit calculator.